From: akr@... Date: 2016-05-04T15:35:42+00:00 Subject: [ruby-core:75350] [Ruby trunk Bug#9569] SecureRandom should try /dev/urandom first Issue #9569 has been updated by Akira Tanaka. I think switching OpenSSL to getrandom() is possible if the performance is acceptable. The man page for getrandom(), http://man7.org/linux/man-pages/man2/getrandom.2.html doesn't discourage non-seed cryptgraphic purposes. OpenBSD's getentropy() has limitation on buffer size: 256 bytes. http://man.openbsd.org/OpenBSD-current/man2/getentropy.2 Some gems use SecureRandom.random_bytes(more-than-256). So, making SecureRandom.random_bytes as single getentropy() invocation causes incompatibility. arc4random may be possible. However, I'm not sure that arc4random is preferable over OpenSSL. ---------------------------------------- Bug #9569: SecureRandom should try /dev/urandom first https://bugs.ruby-lang.org/issues/9569#change-58478 * Author: Corey Csuhta * Status: Rejected * Priority: Normal * Assignee: ruby-core * ruby -v: * Backport: ---------------------------------------- Right now, `SecureRandom.random_bytes` tries to detect an OpenSSL to use before it tries to detect `/dev/urandom`. I think it should be the other way around. In both cases, you just need random bytes to unpack, so SecureRandom could skip the middleman (and [second point of failure](http://sockpuppet.org/blog/2014/02/25/safely-generate-random-numbers/)) and just talk to `/dev/urandom` directly if it's available. Is this a case of just re-ordering the two code chunks so that `/dev/urandom` is tried first? Relevant lines: https://github.com/ruby/ruby/blob/trunk/lib/securerandom.rb#L59-L90 -- https://bugs.ruby-lang.org/ Unsubscribe: